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(57) Abstract 

The present invention relates to various methods of encrypting an information flow (speech or data) which is to be transmitted in a 
mobile radio system. The mobile radio system transfers information in accordance with the time divisidn multiple access concept (TDMA) 
between a network (MSC, BSS) and a specific mobile station (MS) from among a plurality of mobile stations. The proposed encryption 
methods are used when information (Bl, B2) of a given user shall be transferred in two or more time slots (TS1, TS2) withina sinele frame 
In accordance with the inventive encryption methods, the various parameters (Kc. FN, PS) used in the encryption process are modified in 
dependence ors i the ordinal number of each of the used time slots in a frame. For instance, the encryption key (Kc) and the frame number 
(FN) are modified in dependence on the ordinal number (TSn) of the relevant time slot and the known encryption algorithm (A5) is used to 
obtain a modified encryption sequence (PSm'). This obviates the need to make substantial changes to the system signalling protocols and 

flaFQ Ware. ^ 
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METHOD FOR ENCRYPTION OF INFORMATION 

FIELD OF INVENTION 

5 The present invention relates to a method of encrypting 
information between a stationary network and a mobile station 
in a mobile radio system of the time division multiple access 
type (TDMA system) . 

10 More specifically, the invention relates to methods of 
encrypting the transmitted information in a more secure 
fashion in conjunction with an authorization check on the 
mobile by the network and when a multiple of time slots are 
used for the same user (mobile station) . 



15 



30 



DESCRIPTION OF THE BACKGROUND ART 



The GSM-network, common in Europe, is a mobile radio network 
that uses time division multiple access (TDMA) . As with other 

20 mobile radio networks, the GSM network employs authorization 
checks and encryption of transmitted messages. With regard 
to the GSM network, this is specified in "GSM specification 
03.20", May 1994, issued by ETSI (European Telecommunication 
Standard Institute) and hereinafter referred to as ETSI/GSM 

25 03.20. The various algorithms used in authorization checks 
and encryption are described in this reference. 

An algorithm A3 is used to effect actual authorization checks 
between network and subscriber apparatus, an algorithm A5 is 
used for encryption of the payload information to be trans- 
mitted, and an algorithm A8 is used to form from the sub- 
scriber authorization key Ki an encryption key Kc from a 
random number variable, RAND. 

5 As a rule, only one time slot per frame for a given connec- 
tion is used in TDMA-type time division mobile radio systems; 
see ETSI/GSM 05.02. 



WO 97/12461 



PCT/SE96/01156 



The use of two or more time slots, not necessarily 

tive time slots, in a transmission frame has been i __ m 

see ETSI/STC SM63 , T doc SMG3 WPA 95A dated 29th August 1995 
(Nokia Telecommunications) , see particularly point 5 "HSCSD 
Architecture". This provides the advantage of enabling larger 
quantities of information to be transmitted per unit of time 
(applicable particularly to data transmissions) , but has the 
drawback of increasing bandwidth. 

SUMMARY OP THE INVENTION 

The inclusion in a GSM system of two or more time slots 
instead of one time slot for one and the same radio transmis- 
sion in accordance with the aforegoing creates certain 
problems when encryption and authorization checks are to be 
employed. 

The most obvious procedure would be to process each of the 
time slots separately and to process the information in 
accordance with earlier known principles. However, such 
procedures would require drastic modification to the existing 
signalling protocols and to equipment on both the network 
side and the mobile station side. 

It would be desirable to avoid such modifications to existing 
standards and equipment to the greatest possible extent. The 
use of the same pseudo-random sequence for all time slots 
within one and the same frame and for a given frame number 
is proposed in the aforementioned ETSI document, ETSI/ T doc 
SMG3, "First HSCSD stage 2 draft". The drawback with this 
method is that it is necessary to compromise between encryp- 
tion safety and procedure simplicity. When two separate 
bursts belonging to one and the same user are transmitted in 
this manner while using the same encryption sequence (pseudo- 
random random sequence) , the influence of the encryption can 
be eliminated relatively simply, by carrying out simple EXOR 
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The object of the present invention is therefore to provide 
methods for reliable encryption in respect of authorization 
checks in a TDMA— type mobile radio system in which two or 
more time slots are used for one and the same transmission 
without needing to make substantial changes to the signalling 
protocol and/or system equipment. 

In this regard, an inventive method is characterized by the 
features set forth in the following Claim 1. Another inven- 
tive method is characterized by the features set forth in the 
accompanying Claim 3. Further inventive methods are charac- 
terized by the features set forth in accompanying Claims 4 
and 5. 



BRIEF DESCRIPTION OF THE DRAWINGS 



The aforesaid inventive methods will now be described in more 
detail with reference to the accompanying drawings. 

Figure l illustrates schematically signalling between a 
network side and a mobile station side in a mobile radio 
system during the authorization check procedure. 

Figure 2 is a block diagram illustrating known information 
encryption in the system illustrated in Figure 1. 

Figure 3 is a block diagram which symbolizes the algorithms 
used in two of the inventive methods. 

Figure 4 is a block diagram symbolizing the algorithms used 
in a third inventive method. 



DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

Figure 1 is a simplified schematic illustration of a mobile 
radio system, for instance a GSM-system. The system has a 
network side "NETWORK" and a mobile station side "Mobile". 
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4 

The network side includes a base station system BSS which is 
connected to a mobile switching centre MSC, which is connect- 
ed, in turn, to the public telephone network (not shown) . The 
base station system BSS typically includes a base transceiver 
5 station BTS and a base station controller BSC (not shown) . 
In reality, a plurality of base station systems are connected 
to the mobile switching centre MSC on the network side, while 
the mobile station side includes a plurality of mobile 
stations that can communicate simultaneously with the base 
10 station system BSS. The network side and the mobile station 
side transmit information via radio signals over an air 
interface which is symbolized in Figure l with the reference 
TR. 



15 Before the actual information is transmitted and received 
between the network and a given mobile station MS, the 
network is obliged to check the authorization of the mobile 
station MS. This authorization check is carried out in 
accordance with known principles, whereby the network, i.e. 

20 the base station system BSS, sends a random number (so-called 
"random challenge") RAND to the mobile station MS over a 
dedicated control channel DCCH. 



The mobile station MS receives the random number RAND and 
forms a response SRES (signed response) from this random 
number and from the mobile station's own key Ki in accordance 
with a given algorithm A3, as described on page 50 of the 
aforesaid ETS I/GSM 03.20. 



30 At the same time, the mobile station MS compiles an encryp- 
tion key Kc from the key Ki in accordance with another 
algorithm A8, although only the response SRES is sent to the 
base station system BSS, while the encryption key Kc is used 
in the encryption carried out in the mobile station in 

35 accordance with the following. A comparison is made in the 
base station system BSS with corresponding values of SRES 
calculated by the mobile switching center (MSC) in accordance 
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with the same conventional algorithms A3 and A8 found in the 
mobile station MS. When a coincidental result is obtained, 
the mobile station is considered to be authorized and 
communication can continue. The continued information 
transmission will thereafter be encrypted in accordance with 
a given algorithm A5, as described on pages 48-49 of ETSI/GSM 
03.20. 



Thus, the network includes an algorithm block AN which stores 
and carries out an authorization check in accordance with the 
algorithms A3 and A8 and encryption in accordance with the 
algorithm A5. The mobile station MS includes a corresponding 
algorithm block AM which stores and carries out an authoriza- 
tion check in accordance with the same algorithms A3 and A8 
and encryption in accordance with the algorithm A5. 

The encryption key Kc is generated by the mobile switching 
center (MSG) on the basis of the mobile station's encryption 
key Ki, which is known to the mobile telephone switching 
centre. Subsequent to making the authorization check, 
(algorithm A5) , the mobile telephone switching centre MSC 
sends the key Kc to the base station system BSS and encryp- 
tion of payload information can be commenced with the aid of 
the agreed encryption key Kc. 



Figure 2 illustrates 
payload information is 
sion over two time 
aforesaid NOKIA proposal 



schematically the manner in which the 
encrypted and formatted for transmis- 
TSl, TS2 in accordance with the 



Normally, the payload information is divided from, e.g., a 
speech frame into one or more blocks each of 114 bits. One 
such block is encrypted in accordance with the algorithm A5 
and sent during a burst in a given time slot, optionally 
interfoliated with another adjacent block. The next encrypted 
block then follows. As illustrated in Figure 2, when two time 
slots in a given frame are available, an information block 
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is now divided into two sub-blocks Bl and B2, each containing 
114 bits, and each block is encrypted with the same pseudo- 
random sequence PS of 114 bits as normal, by carrying out two 
EXOR operations shown in Figure 2. 

5 

The pseudo-random sequence PS is obtained from an ordinal 
number FN of the frame in which the time slots TS1, TS2 are 
located whose information (blocks Bl and B2) shall be 
encrypted. Two encrypted information blocks BK1 and BK2 are 

10 obtained and these blocks are then formatted by inserting a 
sync, and training sequence in a known manner (marked with 
X in Figure 2) . As before mentioned, the drawback with this 
encryption method is that the same encryption sequence is 
used two times for two separate time slots which means that 

15 non-encrypted information can be recovered from each of the 
two time slots by an EXOR operation between the encrypted 
information. 



In accordance with the present invention, the time slot 

20 ordinal number or an equivalent to this number is inserted 
into the frame as a further parameter when encrypting. As a 
result, when transmitting in two time slots within the same 
frame, the transmitted information will be independently 
encrypted and encryption security therewith further enhanced 

25 in comparison to the case when only the frame number (in 
addition to the encryption key) is used. If, as is normal, 
a user uses only one time slot per frame, no time-slot 
dependent encryption is required because the user's authori- 
zation key is unique for a certain time slot. By modifying 

30 the input parameters (code key Kc, frame number FN) in direct 
dependence on the ordinal number of a time slot in a frame 
in accordance with the present invention, it is possible to 
apply the original algorithms without needing to make any 
substantial change to the signalling protocol, as before 

35 described, or to the radio equipment. 
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Figure 3 is a block diagram illustrating the use of the 
original algorithm A5 with modified input magnitudes in 
accordance with the present invention. 

5 The block AB in Figure 3 symbolizes the original algorithm 
A5, which is specified in accordance with GSM 03.20. The 
encryption key Kc is now modified in accordance with the 
ordinal number TSn=TSl of the relevant time slot, namely the 
time slot in the frame during which a first block Bl accord- 

10 ing to Figure 2 shall be transmitted (possibly interfoliated 
with an adjacent block, although the principle is the same). 
In this regard, circle 1 symbolizes a calculation algorithm 
ALG1 for obtaining a modified value Kcl of the encryption 
key. The same algorithm can be used for all time slots in the 

15 frame, such that 



AI/31(Kc,TSn) = Kcn«. 



It is not necessary to modify all encryption keys and one key 
may be identical to the normal encryption key Kc for a given 
time slot. 



Similarly, the frame ordinal number FN is modified in 
dependence on the ordinal number TSn=TSl of the relevant time 
5 slot in the frame within which the first block Bl in Figure 
2 shall be transmitted. Circle 2 therewith symbolizes a 
calculation algorithm ALG2 for obtaining the modified value 
FN' of the frame ordinal number. The same algorithm can be 
used for all time slots in the frame, such that 

0 

ALG2 (FN, TSn) = FNn • . 
The two algorithms ALG1 and ALG2 need not be equal. 

5 Furthermore, one of the modified frame numbers FNn * may be 
identical to the normal FN. 
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10 



In both of the aforesaid cases, there is obtained an output 
magnitude in the form of a modified pseudo-random sequence 
PSm 1 which is used in the same way as that shown in Figure 
2. 

It will be understood that the sequence PSm 1 can also be 
generated either 

a) by solely using a modified value Kc 1 on the encryption key 
and an unchanged value FN on the frame number, i.e. the 
algorithm 2 is not used; or 

b) by solely using a modified value FN 1 on the frame number 
FN and an unchanged value on the encryption key Kc, i.e. 

15 the algorithm 1 is not used. 

Figure 4 is a block diagram similar to the block diagram of 
Figure 3, but now with totally unchanged input values Kc, FN 
to the algorithm A5. Instead, the time slot ordinal number 

20 TSn (or a value equivalent to said ordinal number) is used 
as a control value for an algorithm ALG3 symbolized by circle 
3 for modifying the normal pseudo-random sequence PS obtained 
from Kc and FN. This algorithm ALG3 may consist in a certain 
permutation, shift, reordering of values, etc., in the 

25 pseudo-random sequence PS, so as to obtain a new sequence 
PSm 1 . The sequence may optionally be divided into blocks of 
114 bits prior to reformulation, and the values in one or 
more blocks can be mixed to obtain the new values with an un- 
changed number of bits (114) in each block. 

30 



is also possible to combine the algorithms ALG1,2 in 
Figure 3 with the algorithm ALG3 according to Figure 4. 

The aforedescribed embodiments of the proposed method relate 
35 to transmission cases. It will be understood that in the case 
of reception wherein incoming information shall be decrypted, 
the values of Kc and FN and the sequence PS will be modified 
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9 

to Kc f , FN' and PSm' respectively in accordance with the 
agreed algorithms ALG1, ALG3 and ALG3 as described above. 
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10 
CLAIMS 

1. A method of encrypting information transmitted between 
a fixed network (MSC, BSS) and a mobile station (MS) in a 
5 mobile radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
10 encryption is effected by 

a) forming a pseudo-random sequence (PS) in accordance with 
a given encryption algorithm (A5) from an encryption key (Kc) 
and the ordinal number (FN) of the frame in which the 
information is transmitted; 
15 b) performing a logic operation (EXOR) between said pseudo- 
random sequence (PS) and each block (Bl and B2) of the non- 
encrypted information to obtain encrypted information (BK1, 
BK2 ) ; 

characterized by 

20 c) modifying said encryption key (Kc) in accordance with a 
given algorithm (ALG1) and in dependence on the ordinal 
number of a time slot (TSn) so as to obtain a modified 
encryption key (Kc f ); 

d) forming a modified pseudo-random sequence (PSm 1 ) from the 
25 resultant modified encryption key (Kc f ) in accordance with 

aid encryption algorithm A5) ; and 

e) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm 1 ) and for each block (Bl and B2) 
of the non-encrypted information. 



30 



2. A method according to Claim 1, characterized by carrying 
out the operation performed in accordance with e) on the 
information block (Bl) that belongs to the time slot (TS1) 
whose ordinal number has been used to form said modified 
encryption key. 



WO 97/12461 



PCT/SE96/01156 



11 

3. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 
radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
5 divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
encryption is effected by 

a) forming a pseudo-random sequence (PS) in accordance with 
10 a given encryption algorithm (A5) from an encryption key (Kc) 

and the ordinal number (FN) of the frame in which the 
information is transmitted; 

b) performing a logic operation (EXOR) between said pseudo- 
random sequence (PS) and each block (Bl and B2) of non- 
15 encrypted information to obtain encrypted information (BK1, 

BK2 ) ; 

characterized by 

c) modifying said frame number (FN) in accordance with a 
given algorithm (ALG2) and in dependence on the ordinal 

20 number of a relevant time slot (TSn) ; 

d) forming a modified pseudo-random sequence (PSm 1 ) from the 
obtained modified frame number (FN') in accordance with said 
encryption algorithm (A5) ; and 

e) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm 1 ) for each block (Bl and B2) of 
non-encrypted information. 



4. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 

30 radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 

35 encryption is effected by 

a) forming a pseudo-random sequence (PS) from an encryption 
key (Kc) and the ordinal number (FN) of the frame in which 



WO 97/12461 



PCT/SE96/01156 



12 

is transmitted in accordance with a given 
encryption algorithm (A5) ; 

b) performing a logic operation (EXOR) between said pseudo- 
random sequence and each block of the non-encrypted informa- 

5 tion (INFOl) ; 

characterized by 

c) modifying said encryption key (Kc) in accordance with a 
given algorithm (ALG1) and in dependence on the ordinal 
number of the relevant time slot (TSn) ; 

10 d) forming a modified pseudo-random sequence (PSm 1 ) from the 
obtained modified encryption key (Kc 1 ) in accordance with 
said encryption algorithm (A5) ; 

e) modifying said frame number (FN) in accordance with a 
given algorithm (ALG2) and in dependence on the ordinal 

15 number of a relevant time slot (TSn) ; 

f) forming a modified pseudo-random sequence (PSm*) from the 
obtained modified frame number (FN 1 ) in accordance with said 
encryption algorithm (A5) ; and 

g) performing said logic operation (EXOR) on the modified 
20 pseudo-random sequence (PSm f ) for each block (Bl and B2) of 

the non-encrypted information. 

5. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 

25 radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 

30 encryption is effected by 

a) forming a pseudo-random sequence (PS) from an encryption 
key (Kc) and the ordinal number (FN) of the frame in which 
the information is transmitted in accordance with a given 
encryption algorithm (A5) ; 

35 b) performing a logic operation (EXOR) between said pseudo- 
random sequence and each block of the non-encrypted informa- 
tion (INFOl) ; 
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characterized by 

c) forming a modified pseudo-random sequence (PSm') from said 
pseudo-random sequence (PS) in dependence on the ordinal 
number (TSn) of the time slot within which the information 

5 block (Bl or B2) that is encrypted with the modified pseudo- 
random sequence shall be transmitted in accordance with a 
given algorithm (ALG3) ; and 

d) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm') for each block (Bl and B2) of 

10 the non-encrypted information. 
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AMENDED CLAIMS 

Lreceived by the International Bureau on 11 February 1997 (11 02 97)- 
original claims 1-5 replaced by new claims 1-5 (3 pages)] 

1. A method of encrypting information transmitted between 
a fixed network (MSC, BSS) and a mobile station (MS) in a 
mobile radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2 ) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
encryption is effected by 

a) forming a pseudo-random sequence (PS) in accordance with 
a given encryption algorithm (A5) from an encryption key (Kc) 
and the ordinal number (FN) of the frame in which the 
information is transmitted; 

b) performing a logic operation (EXOR) between said pseudo- 
random sequence (PS) and each block (Bl and B2) of the non- 
encrypted information to obtain encrypted information (BK1, 
BK2 ) ; 

cterized by 

c) modifying said encryption key (Kc) in accordance with a 
given algorithm (ALG1) and in dependence on the ordinal 
number of a time slot (TSn) so as to obtain a modified 
encryption key (Kc'); 

d) forming a modified pseudo-random sequence (PSm') from the 
resultant modified encryption key (KC) obtained from each 
of the used time slots and in accordance with aid encryption 
algorithm A5) ; and 

e) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm') and for the respective block 
(Bl and B2) of the non-encrypted information. 

2. A method according to Claim 1, characterized by carrying 
out the operation performed in accordance with e) on the 
information block (Bl) that belongs to the time slot (TSl) 
whose ordinal number has been used to form said modified 
encryption key. 

AMENDED SHEET (ARTICLE 19) 
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3. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 
radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
encryption is effected by 

a) forming a pseudo-random sequence (PS) in accordance with 
a given encryption algorithm (A5) from an encryption key (Kc) 
and the ordinal number (FN) of the frame in which the 
information is transmitted; 

b) performing a logic operation (EXOR) between said pseudo- 
random sequence (PS) and each block (Bl and B2) of non- 
encrypted information to obtain encrypted information (BK1, 
BK2) ; 

characterized by 

c) modifying said frame number (FN) in accordance with a 
given algorithm (ALG2) and in dependence on the ordinal 
number of a relevant time slot (TSn) ; 

d) forming a modified pseudo-random sequence (PSm') from the 
obtained frame number (FN') modified for each of the time 
slots used and in accordance with said encryption algorithm 
(A5) ; and 

e) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm 7 ) for the respective block (Bl 
and B2) of non-encrypted information. 

4. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 
radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
encryption is effected by 

AMENDED SHEET (ARTICLE 19) 
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a) forming a pseudo-random sequence (PS) from an encryption 
key (Kc) and the ordinal number (FN) of the frame in which 
the information is transmitted in accordance with a given 
encryption algorithm (A5) ; 

b) performing a logic operation (EXOR) between said pseudo- 
random sequence and each block of the non-encrypted informa- 
tion (INFOl) ; 

characterized by 

c) modifying said encryption key (Kc) in accordance with a 
given algorithm (ALG1) and in dependence on the ordinal 
number of the relevant time slot (TSn) ; 

d) forming a modified pseudo-random sequence (PSm') from the 
obtained encryption key (Kc' ) modified for each of the time 
slots used and in accordance with said encryption algorithm 
(A5) ; 

e) modifying said frame number (FN) in accordance with a 
given algorithm (ALG2) and in dependence on the ordinal 
number of a relevant time slot (TSn) ; 

f) forming a modified pseudo-random sequence (PSm') from the 
obtained modified frame number (FN') in accordance with said 
encryption algorithm (A5) ; and 

g) performing said logic operation (EXOR) on the modified 
pseudo-random sequence (PSm') for each block (Bl and B2) of 
the non-encrypted information. 

5. A method of encrypting information transmitted between 
a fixed network (N) and a mobile station (MS) in a mobile 
radio system that operates in accordance with the time 
division multiple access concept, wherein the information is 
divided into at least two blocks (Bl, B2) and transmitted in 
at least two time slots (TS1, TS2) corresponding to said 
blocks in each frame in a frame sequence, and wherein 
encryption is effected by 

a) forming a pseudo-random sequence (PS) from an encryption 
key (Kc) and the ordinal number (FN) of the frame in which 
the information is transmitted in accordance with a given 
encryption algorithm (A5) ; 
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